Skip to content

feat: add support CycloneDX 1.7.1 & 1.6.2 & 1.5.1 #985

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jkowalleck merged 2 commits into from
Jun 4, 2026
Merged

feat: add support CycloneDX 1.7.1 & 1.6.2 & 1.5.1 #985

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
c28e1e6
schemas for CycloneDX 1.7.1 & 1.6.2 & 1.5.1
jkowalleck Jun 4, 2026
7cb8c8c
docs
jkowalleck Jun 4, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion cyclonedx/schema/_res/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ some schema for offline use as downloaded via [script](../../../tools/schema-dow
original sources: <https://github.com/CycloneDX/specification/tree/master/schema>

Currently using version
[4b3f59453366e27c8073fd24e98bf21ef8892c8e](https://github.com/CycloneDX/specification/commit/4b3f59453366e27c8073fd24e98bf21ef8892c8e)
[b29bae660048e0ad2fbc5f2972927b442ce951c4](https://github.com/CycloneDX/specification/commit/b29bae660048e0ad2fbc5f2972927b442ce951c4)

| file | note |
|------|------|
Expand Down
20 changes: 15 additions & 5 deletions cyclonedx/schema/_res/bom-1.5.SNAPSHOT.xsd
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,7 @@ limitations under the License.
targetNamespace="http://cyclonedx.org/schema/bom/1.5"
vc:minVersion="1.0"
vc:maxVersion="1.1"
version="1.5.0">
version="1.5.1">

<xs:import namespace="http://cyclonedx.org/schema/spdx" schemaLocation="spdx.SNAPSHOT.xsd"/>

Expand Down Expand Up @@ -2885,7 +2885,7 @@ limitations under the License.
</xs:annotation>
<xs:complexType>
<xs:sequence>
<xs:element name="user" type="xs:string" minOccurs="0" maxOccurs="1" />
<xs:element name="user" type="xs:string" minOccurs="0" maxOccurs="unbounded" />
</xs:sequence>
</xs:complexType>
</xs:element>
Expand All @@ -2897,7 +2897,7 @@ limitations under the License.
</xs:annotation>
<xs:complexType>
<xs:sequence>
<xs:element name="useCase" type="xs:string" minOccurs="0" maxOccurs="1" />
<xs:element name="useCase" type="xs:string" minOccurs="0" maxOccurs="unbounded" />
</xs:sequence>
</xs:complexType>
</xs:element>
Expand All @@ -2911,7 +2911,7 @@ limitations under the License.
</xs:annotation>
<xs:complexType>
<xs:sequence>
<xs:element name="technicalLimitation" type="xs:string" minOccurs="0" maxOccurs="1" />
<xs:element name="technicalLimitation" type="xs:string" minOccurs="0" maxOccurs="unbounded" />
</xs:sequence>
</xs:complexType>
</xs:element>
Expand All @@ -2923,7 +2923,7 @@ limitations under the License.
</xs:annotation>
<xs:complexType>
<xs:sequence>
<xs:element name="performanceTradeoff" type="xs:string" minOccurs="0" maxOccurs="1" />
<xs:element name="performanceTradeoff" type="xs:string" minOccurs="0" maxOccurs="unbounded" />
</xs:sequence>
</xs:complexType>
</xs:element>
Expand Down Expand Up @@ -3008,6 +3008,16 @@ limitations under the License.
</xs:sequence>
</xs:complexType>
</xs:element>
<xs:element name="properties" type="bom:propertiesType" minOccurs="0" maxOccurs="1">
<xs:annotation>
<xs:documentation>Provides the ability to document properties in a name/value store.
This provides flexibility to include data not officially supported in the standard
without having to use additional namespaces or create extensions. Property names
of interest to the general public are encouraged to be registered in the
CycloneDX Property Taxonomy - https://github.com/CycloneDX/cyclonedx-property-taxonomy.
Formal registration is OPTIONAL.</xs:documentation>
</xs:annotation>
</xs:element>
</xs:sequence>
<xs:attribute name="bom-ref" type="bom:refType">
<xs:annotation>
Expand Down
6 changes: 3 additions & 3 deletions cyclonedx/schema/_res/bom-1.6.SNAPSHOT.schema.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -536,7 +536,7 @@
"description": "Identifier for referable and therefore interlinkable elements.\nValue SHOULD not start with the BOM-Link intro 'urn:cdx:' to avoid conflicts with BOM-Links.",
"type": "string",
"minLength": 1,
"$comment": "TODO (breaking change): add a format constraint that prevents the value from staring with 'urn:cdx:'"
"$comment": "TODO (breaking change): add a format constraint that prevents the value from starting with 'urn:cdx:'"
},
"refLinkType": {
"description": "Descriptor for an element identified by the attribute 'bom-ref' in the same BOM document.\nIn contrast to `bomLinkElementType`.",
Expand Down Expand Up @@ -1161,7 +1161,7 @@
"contentType": {
"type": "string",
"title": "Content-Type",
"description": "Specifies the format and nature of the data being attached, helping systems correctly interpret and process the content. Common content type examples include `application/json` for JSON data and `text/plain` for plan text documents.\n [RFC 2045 section 5.1](https://www.ietf.org/rfc/rfc2045.html#section-5.1) outlines the structure and use of content types. For a comprehensive list of registered content types, refer to the [IANA media types registry](https://www.iana.org/assignments/media-types/media-types.xhtml).",
"description": "Specifies the format and nature of the data being attached, helping systems correctly interpret and process the content. Common content type examples include `application/json` for JSON data and `text/plain` for plain text documents.\n [RFC 2045 section 5.1](https://www.ietf.org/rfc/rfc2045.html#section-5.1) outlines the structure and use of content types. For a comprehensive list of registered content types, refer to the [IANA media types registry](https://www.iana.org/assignments/media-types/media-types.xhtml).",
"default": "text/plain",
"examples": [
"text/plain",
Expand Down Expand Up @@ -2681,7 +2681,7 @@
"ratings": {
"type": "array",
"title": "Ratings",
"description": "List of vulnerability ratings",
"description": "List of vulnerability ratings. Consumers SHOULD consider ratings in prioritization decisions; source ratings may differ and aid prioritization.",
"items": {
"$ref": "#/definitions/rating"
}
Expand Down
24 changes: 17 additions & 7 deletions cyclonedx/schema/_res/bom-1.6.SNAPSHOT.xsd
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,7 @@ limitations under the License.
targetNamespace="http://cyclonedx.org/schema/bom/1.6"
vc:minVersion="1.0"
vc:maxVersion="1.1"
version="1.6.1">
version="1.6.2">

<xs:import namespace="http://cyclonedx.org/schema/spdx" schemaLocation="spdx.SNAPSHOT.xsd"/>

Expand Down Expand Up @@ -973,7 +973,7 @@ limitations under the License.
<xs:documentation>
Specifies the format and nature of the data being attached, helping systems correctly
interpret and process the content. Common content type examples include `application/json`
for JSON data and `text/plain` for plan text documents.
for JSON data and `text/plain` for plain text documents.
RFC 2045 section 5.1 outlines the structure and use of content types. For a comprehensive
list of registered content types, refer to the IANA media types registry at
https://www.iana.org/assignments/media-types/media-types.xhtml.
Expand Down Expand Up @@ -3256,7 +3256,7 @@ limitations under the License.
</xs:annotation>
<xs:complexType>
<xs:sequence>
<xs:element name="user" type="xs:string" minOccurs="0" maxOccurs="1" />
<xs:element name="user" type="xs:string" minOccurs="0" maxOccurs="unbounded" />
</xs:sequence>
</xs:complexType>
</xs:element>
Expand All @@ -3268,7 +3268,7 @@ limitations under the License.
</xs:annotation>
<xs:complexType>
<xs:sequence>
<xs:element name="useCase" type="xs:string" minOccurs="0" maxOccurs="1" />
<xs:element name="useCase" type="xs:string" minOccurs="0" maxOccurs="unbounded" />
</xs:sequence>
</xs:complexType>
</xs:element>
Expand All @@ -3282,7 +3282,7 @@ limitations under the License.
</xs:annotation>
<xs:complexType>
<xs:sequence>
<xs:element name="technicalLimitation" type="xs:string" minOccurs="0" maxOccurs="1" />
<xs:element name="technicalLimitation" type="xs:string" minOccurs="0" maxOccurs="unbounded" />
</xs:sequence>
</xs:complexType>
</xs:element>
Expand All @@ -3294,7 +3294,7 @@ limitations under the License.
</xs:annotation>
<xs:complexType>
<xs:sequence>
<xs:element name="performanceTradeoff" type="xs:string" minOccurs="0" maxOccurs="1" />
<xs:element name="performanceTradeoff" type="xs:string" minOccurs="0" maxOccurs="unbounded" />
</xs:sequence>
</xs:complexType>
</xs:element>
Expand Down Expand Up @@ -3386,6 +3386,16 @@ limitations under the License.
</xs:sequence>
</xs:complexType>
</xs:element>
<xs:element name="properties" type="bom:propertiesType" minOccurs="0" maxOccurs="1">
<xs:annotation>
<xs:documentation>Provides the ability to document properties in a name/value store.
This provides flexibility to include data not officially supported in the standard
without having to use additional namespaces or create extensions. Property names
of interest to the general public are encouraged to be registered in the
CycloneDX Property Taxonomy - https://github.com/CycloneDX/cyclonedx-property-taxonomy.
Formal registration is OPTIONAL.</xs:documentation>
</xs:annotation>
</xs:element>
</xs:sequence>
<xs:attribute name="bom-ref" type="bom:refType">
<xs:annotation>
Expand Down Expand Up @@ -4218,7 +4228,7 @@ limitations under the License.
</xs:element>
<xs:element name="ratings" minOccurs="0" maxOccurs="1">
<xs:annotation>
<xs:documentation xml:lang="en">List of vulnerability ratings.</xs:documentation>
<xs:documentation xml:lang="en">List of vulnerability ratings. Consumers SHOULD consider ratings in prioritization decisions; source ratings may differ and aid prioritization.</xs:documentation>
</xs:annotation>
<xs:complexType>
<xs:sequence>
Expand Down
12 changes: 6 additions & 6 deletions cyclonedx/schema/_res/bom-1.7.SNAPSHOT.schema.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -555,7 +555,7 @@
"description": "Identifier for referable and therefore interlinkable elements.\nValue SHOULD not start with the BOM-Link intro 'urn:cdx:' to avoid conflicts with BOM-Links.",
"type": "string",
"minLength": 1,
"$comment": "TODO (breaking change): add a format constraint that prevents the value from staring with 'urn:cdx:'"
"$comment": "TODO (breaking change): add a format constraint that prevents the value from starting with 'urn:cdx:'"
},
"refLinkType": {
"title": "BOM Reference",
Expand Down Expand Up @@ -981,7 +981,7 @@
"versionRange": {
"$ref": "#/definitions/versionRange",
"title": "Component Version Range",
"description": "For an external component, this specifies the accepted version range.\nThe value must adhere to the Package URL Version Range syntax (vers), as defined at <https://github.com/package-url/vers-spec\nMay only be used if `.isExternal` is set to `true`.\nMust be used exclusively, either 'version' or 'versionRange', but not both."
"description": "For an external component, this specifies the accepted version range.\nThe value must adhere to the Package URL Version Range syntax (vers), as defined at https://github.com/package-url/vers-spec\nMay only be used if `.isExternal` is set to `true`.\nMust be used exclusively, either 'version' or 'versionRange', but not both."
},
"isExternal": {
"type": "boolean",
Expand Down Expand Up @@ -1079,7 +1079,7 @@
"ancestors": {
"type": "array",
"title": "Ancestors",
"description": "Describes zero or more components in which a component is derived from. This is commonly used to describe forks from existing projects where the forked version contains a ancestor node containing the original component it was forked from. For example, Component A is the original component. Component B is the component being used and documented in the BOM. However, Component B contains a pedigree node with a single ancestor documenting Component A - the original component from which Component B is derived from.",
"description": "Describes zero or more components in which a component is derived from. This is commonly used to describe forks from existing projects where the forked version contains an ancestor node containing the original component it was forked from. For example, Component A is the original component. Component B is the component being used and documented in the BOM. However, Component B contains a pedigree node with a single ancestor documenting Component A - the original component from which Component B is derived from.",
"items": {"$ref": "#/definitions/component"}
},
"descendants": {
Expand All @@ -1103,7 +1103,7 @@
"patches": {
"type": "array",
"title": "Patches",
"description": ">A list of zero or more patches describing how the component deviates from an ancestor, descendant, or variant. Patches may be complementary to commits or may be used in place of commits.",
"description": "A list of zero or more patches describing how the component deviates from an ancestor, descendant, or variant. Patches may be complementary to commits or may be used in place of commits.",
"items": {"$ref": "#/definitions/patch"}
},
"notes": {
Expand Down Expand Up @@ -1248,7 +1248,7 @@
"contentType": {
"type": "string",
"title": "Content-Type",
"description": "Specifies the format and nature of the data being attached, helping systems correctly interpret and process the content. Common content type examples include `application/json` for JSON data and `text/plain` for plan text documents.\n [RFC 2045 section 5.1](https://www.ietf.org/rfc/rfc2045.html#section-5.1) outlines the structure and use of content types. For a comprehensive list of registered content types, refer to the [IANA media types registry](https://www.iana.org/assignments/media-types/media-types.xhtml).",
"description": "Specifies the format and nature of the data being attached, helping systems correctly interpret and process the content. Common content type examples include `application/json` for JSON data and `text/plain` for plain text documents.\n [RFC 2045 section 5.1](https://www.ietf.org/rfc/rfc2045.html#section-5.1) outlines the structure and use of content types. For a comprehensive list of registered content types, refer to the [IANA media types registry](https://www.iana.org/assignments/media-types/media-types.xhtml).",
"default": "text/plain",
"examples": [
"text/plain",
Expand Down Expand Up @@ -2841,7 +2841,7 @@
"ratings": {
"type": "array",
"title": "Ratings",
"description": "List of vulnerability ratings",
"description": "List of vulnerability ratings. Consumers SHOULD consider ratings in prioritization decisions; source ratings may differ and aid prioritization.",
"items": {
"$ref": "#/definitions/rating"
}
Expand Down
Loading
Loading